Multipartite Entanglement Verification Resistant against Dishonest Parties 
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Future quantum information networks will consist of quantum and classical agents, who have the 
ability to communicate in a variety of ways with trusted and untrusted parties and securely delegate 
computational tasks to untrusted large-scale quantum computing servers. Multipartite quantum 
entanglement is a fundamental resource for such a network and hence it is imperative to study the 
possibility of verifying a multipartite entanglement source in a way that is efficient and provides 
strong guarantees even in the presence of multiple dishonest parties. In this Letter, we show how an 
agent of a quantum network can perform a distributed verification of a source creating multipartite 
Greenberger-Horne-Zeilinger (GHZ) states with minimal resources, which is, nevertheless, resistant 
against any number of dishonest parties. Moreover, we provide a tight tradeoff between the level 
of security and the distance between the state produced by the source and the ideal GHZ state. 
Last, by adding the resource of a trusted common random source, we can further provide security 
guarantees for all honest parties in the quantum network simultaneously. 

PACS numbers: 03.65.Ud, 03.67.-a, 03.67.Dd 



Entanglement plays a key role in the study and de- 
velopment of quantum information theory. It has been 
widely used in all aspects of quantum information and 
has been essential to show the advantages obtained com- 
pared to the classical setting. Initially defined for bipar- 
tite states, the notion of entanglement has been general- 
ized to multipartite systems and despite the complexity 
this notion acquires in this case, many interesting prop- 
erties of multipartite entangled states are known. If we 
consider, for example, the quantum correlations of the 
Greenberger-Horne-Zeilinger (GHZ) state [l[ and its n- 
party generalization, we can find a nonlocal game that 
can be won with probability 1 in the quantum setting, 
while any classical local theory can win the game with 
probability at most 3/4 0- 

Multipartite entangled states are a fundamental re- 
source when quantum networks are considered. Indeed, 
they allow network agents to create strong correlations 
in order to perform distributed tasks, to delegate com- 
putation to untrusted servers or to compute, for ex- 
ample through the Measurement-Based Quantum Com- 
putation model Q ■ A natural and fundamental question 
that arises then is whether the network agents should be 
required to trust the source that provides them with such 
multipartite entangled states or whether they are able to 
verify the entanglement. 

In this work, we show that a quantum agent can verify 
efficiently with respect to the necessary resources, that 
an untrusted source creates entanglement, even in the 
presence of dishonest parties. 

The model - We start our analysis by first describing 
in detail our model and its relation to previous work. 

Source: The source is untrusted. It is supposed to 
create the n-party GHZ state -^=(|0 n ) + |1")) and dis- 



tribute it to n parties. By applying a Hadamard and a 
phase shift (Vz) gate to each qubit, the GHZ state can 
be expressed by the locally equivalent state 
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A(y)=0 (mod 4) A(y) = 2 (mod 4) 
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where y is a classical n-bit string yi...y n and A(y) = 
Y]- yi denotes the Hamming weight of y. We will use the 
latter state for our proofs. Such states have a wide range 
of applications, for example in nonlocal games, quantum 
game theory and quantum computation. 

Parties: A party can be honest or dishonest. An hon- 
est party does not know which parties are honest and 
which arc dishonest. The dishonest parties can collabo- 
rate with each other and control the source. Their goal is 
to convince the honest parties that the source can create 
the n-party GHZ state, while in reality this may not be 
true. They are allowed to create a different state every 
time or entangle the state with any auxiliary space. 

Local resources: A party has a trusted single-qubit 
measurement device with two measurement settings and 
a trusted classical random source. 

Network resources: Every pair of parties shares a pri- 
vate classical channel, in other words, the communication 
between two honest parties remains secret. This is the 
standard setup for classical networks with dishonest par- 
ties, since in the absence of private channels we cannot 
guarantee security for more than a single honest party. 

Note that we want to use the least possible resources 
for our protocol. Indeed, we only need each party to 
be able to produce randomness, to perform single-qubit 
measurements and to securely communicate classical in- 
formation with the other parties. Since our goal is to con- 
struct protocols that can be widely available in the near 
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future, it is imperative to minimize the resources avail- 
able to the agents, especially the quantum resources that 
are considered more expensive than the classical ones, 
hence bringing such tasks closer to reality. 

Related work - Most of the work on entanglement 
verification has considered the case where all parties are 
honest. For two parties, three models have been studied. 

First, the standard model, where both parties trust 
their devices but they do not trust the source. This 
model corresponds to the setting of non-separability 
tests, where the two parties can perform together quan- 
tum tomography on the state distributed by the source 
and thus verify the existence of entanglement. In a cryp- 
tographic language, this corresponds to a setting where 
all parties are guaranteed to be honest. A related ques- 
tion concerning untrusted sources in quantum key distri- 
bution protocols is discussed in [f|. 

Second, the device independent model, where the par- 
ties trust neither their quantum devices nor the source. 
This model is related to the well known setting of the 
Bell nonlocality tests as well as to self-testing [6[ . 

Third, the one-sided device independent model 0, 
where the security is asymmetric: one party trusts his 
devices but the second party's devices and the source are 
untrusted. This model corresponds to the setting of gen- 
eralized quantum steering where one party is also 
given control of the source and tries to convince the other 
party, who trusts his devices, that she can create entan- 
glement. In a cryptographic language, an honest party 
tries to verify entanglement in the presence of a dishon- 
est party who controls the source. Recently, there have 
been experimental demonstrations in this model (T^-EH- 

For the multipartite case, much less is known. In the 
standard model, pseudo-telepathy [l3| extends Mermin's 
game f§] to many parties; a maximally entangled state 
is used to play the game and wins with probability one, 
which is strictly better than in the classical case. In the 
device independent model, it was shown that honest par- 
ties who do not trust their devices can verify genuine 
multipartite ent ang lement by using appropriate entangle- 
ment witnesses |l4|. Finally, in [15l | the authors present 
a unified framework for n-party entanglement verifica- 
tion and provide inequalities with different bounds for 
the different nonlocality classes that are considered. 

Our Work - In our model, there are, in general, k 
honest parties and n—k dishonest parties who control the 
source, which is supposed to create an n-party GHZ state. 
Each honest party does not know which other parties are 
honest. Our goal is to provide an efficient test for an 
honest party, such that the test passes only if the state 
produced by the source creates entanglement between all 
k honest parties and the n — k dishonest parties. 

First, if all players are honest, we prove that any n- 
party state that is e-away from the n-party GHZ state 
passes the test with probability at most I — e 2 /2. Sec- 
ond, in the presence of any number of dishonest parties, 



we prove a similar quantitative statement, this time for 
any n-party state that is e-away from the n-party GHZ 
state up to a local unitary operation on the space of the 
dishonest parties. 

For the special case of n = 2, our model significantly 
extends the results in the generalized quantum steering 
setting by providing a tight analysis of the tradeoff be- 
tween the distance of the shared state to the n-party GHZ 
and the probability of success of the test. For the case 
of n = k, i.e. the standard model, our results again pro- 
vide a tight analysis of the tradeoff between the distance 
and the probability the test passes. For general n parties 
and k honest ones, this is the first rigorous analysis of an 
entanglement verification test. 

The Protocol V - Consider a source that is supposed 
to create and distribute the state |$q) to n parties. We 
present a verification protocol V that one party, called 
the Verifier, can run with the other n — 1 parties, in 
order to verify that the state \^f) created by the source 
is in fact the correct one. 

1 . The Verifier selects for each i £ [n] a random input 
X l € {0, 1}, such that YTi=\ X i = ( mod 2 ); and 
sends it to the corresponding party via a private 
classical channel. 

2. If Xi = 0, party i performs a Z operation. 

If Xi = 1, party i performs a Hadamard operation. 

3. Party i measures in the {|0), |1)} basis and sends 
the corresponding outcome Yi £ {0, 1} to the Veri- 
fier via the private channel. 

4. The Verifier accepts the result if and only if: 

n 1 n 

i=l i=l 

The above protocol assumes that a specific party plays 
the role of the Verifier. We will later address the question 
of how to pick such a Verifier among all honest parties. 
Note that this test has been used before [Hj], however 
our analysis is entirely different. We denote by T(\^)) 
the event that the Verifier accepts the result of the Test, 
when the joint state is | VP) . 

Correctness of the protocol - We want to show 
that the state |$q) passes the Test with probability 1. 
We need to define the following state: 

1 r E \y)- E \v) 

A(j/)=1 (mod 4) A(j/)=3 (mod 4) 
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It is easily verifiable (from the definition of the states) 
that for any k and n: 
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n — k\ 



(i) 



From condition Y^i=i X i = (mod 2), we have two 
cases: 
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• {\Y^i=i^i) = (mod 2): This means that the 
sum of the inputs is a multiple of 4. Using Eq. (QJ, 
it can be proven that the state |<I>q) goes to ±|$q) 
when we apply to it an operator consisting of a 
(mod 4) number of single-qubit Hadamards, and Z 
gates on the remaining qubits. Hence we always 
have EILiTi = ( mod 2 )- 

• (I S™=i = l(mod 2): This means that the sum 
of the inputs is even but not a multiple of 4. Again, 
it can be proven that the state |<I>q) goes to ±|$") 
when we apply to it an operator consisting of a 2 
(mod 4) number of single-qubit Hadamards, and Z 
gates on the remaining qubits. Hence we always 
have Yi = 1 (mod 2). 

Security in the Honest Model - We now look at 
the model where all n parties arc honest and analyze the 
probability that our Test accepts a state as a function of 
the distance of this state to |$o). We first analyze the 
case of a pure state. Denoting by D(\ip), \ <f)) the trace 
distance between two states and \4>), we have 

Theorem 1. IfDQty, = e, Pr[T(|*))] < 1 - 4- 

The main idea of the proof is to show that our Test is 
equivalent to performing a POVM {P n ,I — P n } (where 
the first outcome corresponds to acceptance) with 

where S„ denotes the subspace of n-qubit states that 
are orthogonal to both |$q) and |$"), and Ig n denotes 
the projection on this subspace. In other words, we 
show that the state |4>q) passes the Test with proba- 
bility 1, the state |4>") passes the Test with probability 
and all other states in the orthogonal subspace pass 
the Test with probability exactly 1/2. The proof of this 
statement is in fact quite involved and is done by in- 
duction on the dimension of the state (see Appendix 
for details). With this characterization for our Test, 
we express any state |*) such that D(\^}, |$o)) = e 

SLi" 1 e t|$D, where for i > 



independent parties each holding one qubit or whether 
they have colluded to one party. For example, the state 



as |*) 

2, |i>") <E S„ and Y^i=i ef = e 2 , and hence we have 
Pr[T(|tt»]=tr(P n |*»<l-£. 

Note that for a mixed state p = {pi, Pr[T(p)] = 

EjPiPrfTd^j))]. Then, by convexity we have 

Corollary 1. If D(p, = e, Pr[T(p)} < 1 - 

Security in the Dishonest Model - We look now at 
the model where the honest Verifier runs the test in the 
presence of dishonest parties. The Verifier is considered 
to be known to all parties. We prove in this case a the- 
orem similar to the case of all honest parties. It should 
be clear here that there is no way for the honest parties 
to determine whether the dishonest parties act as n — k 



l 

^2 



l*S)|o> - 1^)11) 



where the n — k dis- 



honest parties hold a single qubit, passes the Test with 
probability 1, since the dishonest parties can locally map 
this state to |$o)- Hence, the correct security statement 
must take into account the fact that the dishonest parties 
may apply some operator on their space. 

Theorem 2. Let \^>) be the state of all n parties. If 
e = min[/ D(U\^/), |3?o)), where U is an operator on the 
space of the dishonest parties, then Pr[T(|\]/)] < 1 — 

Let us assume, without loss of generality, that the 
n parties share a state of the form |\&) = |$g)|^o) + 
|$i) l^i) + \X), where in \X) the component of the honest 
parties is orthogonal to |$q) and |5>i), and the dishonest 
state is not normalized. For the dishonest parties, mak- 
ing the Verifier accept the Test is equivalent to guessing 
the honest output Yjj := J2h ^ (mod 2), where H is the 
set of the honest parties, before announcing their mea- 
surement outcomes. The optimal probability of guessing 
Yh given Xh ■= J2h -^i (mod 2) is given by the Hel- 
strom measurement. Let p = jjl^o)!! 2 ; 1 = ill^i)!! 2 an d 
("fol^i) 2 = pqcos 2 9, where 9 is the angle between |^o) 
and l^i). Then, we calculate that: 



rsin 



Pr[ g ue S sY H ] < l-\{l-^±^ 



We consider now that the dishonest parties can per- 
form a local operation on their state, in order to maxi- 
mize their cheating probability. Thus, the distance of the 
dishonest state from the correct one is : e = minuD((I® 
[/)|*), | $")) = minuy/l - F 2 ((I® UWf, l $ o»> where 
by Fdijj), |0)) we denote the fidelity between two states 
and |0). If the reduced density matrices of the honest 
players of the perfect and the real state are an and pn 
respectively, it holds that there exists a local operation 
R on the dishonest state such that: 



p + q + 2Jpqsin9 



F((I®R)\*) > \$%))=F(o- H) p H ) = 

For this operation R, the distance becomes: 

e 2 < 1 - F 2 ((I ® i*)|¥>, |$£)) = 1 - F 2 (a H , p H ), 

which concludes the proof (see Appendix for more de- 
tails). 

Security for all honest parties - We have presented 
a protocol that a Verifier can use to verify the state of 
an untrusted source in the presence of dishonest parties 
with minimal resources. Our protocol can be useful in 
the scenario where some party wants to perform a com- 
plex quantum computation and needs to delegate parts of 
the computation to other parties, who, of course, would 
need some source of multipartite entanglement in order 
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to perform the joint computation. Note that the Verifier 
can repeat the protocol sequentially in order to increase 
the probability of detecting an erroneous state. 

In a more general scenario, however, where parties 
need to perform securely some distributed multipartite 
computation using the multipartite entangled state as an 
initial shared resource, we need to guarantee security for 
all honest parties at the same time. In other words, we 
would like a protocol that guarantees to all honest parties 
that they will only accept to use a state for the computa- 
tion that comes from a source that produces states that 
are very close to an n-party GHZ state. A priori, such 
a task is impossible, since any such protocol could be 
used to produce unbiased strong coins [l6| (the parties 
could just measure the entangled state to produce coins). 
Hence, we need to provide some additional resource. 

Trusted Common Random Source ( CRS): We assume 
that all parties have access to a trusted classical random 
source that provides them with the same randomness. 

This is, of course, a powerful, but necessary, resource. 
One way to achieve it would be to assume that at least a 
third of all parties are honest, since this implies the abil- 
ity to securely produce random bits only with authenti- 
cated classical communication [TtJ ■ Note that in order to 
achieve quantum secure multiparty computation, at least 
a majority of honest parties is required [P8| , in which case 
it is possible to construct a CRS. 

We describe how to repeat our verification test in order 
to guarantee the following: when the parties decide to use 
the state for computation, then the probability that the 
state produced by the source is e-away from the n-party 
GHZ state goes to zero exponentially fast with the num- 
ber of repetitions. Note that our guarantee is on the state 
produced by the source. Of course, we cannot prevent 
the dishonest parties from destroying the entanglement 
with the honest parties just before using this state for 
further computation. However, we argue that our test 
is still useful for secure multiparty computation. First, 
as we noted before, if the goal of the dishonest parties is 
to convince the honest parties of the source's ability to 
create entanglement, destroying the entanglement after 
the source has produced it does not help them. Second, 
in general, in secure multiparty computation, one of the 
main goals is to guarantee that the inputs of the honest 
parties remain secret for the dishonest parties. Since in 
our model the parties will only perform local quantum 
operations (if the parties could send their qubits to other 
parties then checking the source will be much easier by 
having all qubits sent to the verifier), by destroying the 
entanglement, the dishonest parties cannot increase their 
information about the honest parties' inputs. Third, we 
still have a strong guarantee on the honest players' states 
from which they can, for example, extract correlated se- 
cret bits. 

Let S be a security parameter. 
The Symmetric Protocol 



1. The source distributes a state \ty) to the n parties 
(the honest source distributes the state |3?o))- 

2. Parties receive r € {0, 1} and i G [n] from CRS. 

(a) If r = 0, the state is used for computation. 

(b) If r 0, Party i runs Protocol V with If 
he rejects, then abort, otherwise go to Step 1. 

Note that the source may create a different state at ev- 
ery repetition of the protocol. It is also important that 
the state is distributed before the parties receive the ran- 
domness from the CRS. Let C e be the event that the 
symmetric protocol has not aborted and that the state 
used for the computation, which we denote by |\&), is 
such that miny D(U\ty), |3>o)) — e ' where U is an opera- 
tor on the space of the dishonest parties. We will prove 
the following: 

Theorem 3. For all e > 0, Pr[C* £ ] < 2~ s -^. 

The proof is given in the Appendix. When the Verifier 
is dishonest we suppose that the state always passes the 
test. By choosing S = log for some constant 5 > 0, 
all honest parties have the guarantee that the probabil- 
ity the state used has distance at least e from the correct 
one, is at most 1/5. Note that the expected number of 
repetitions of the protocol is 2 , which, with our choice 
of S, is polynomial in n and 1/e (and with probability ex- 
ponentially close to 1 the number of repetitions is at most 
0(2 S )). Moreover, this protocol provides guarantees to 
all honest parties, unlike the case of quantum steering 
and our multipartite generalization. To this end, it was 
necessary to make the assumption of a trusted classical 
random source. 

Discussion - It is important to note that our analysis 
does not take into account losses and noise that appear 
in a realistic setting. It will be interesting to study such 
conditions, as was recently done for bipartite quantum 
steering [10j . We also note that although our results pro- 
vide a verification test for the GHZ state, the analysis 
should in principle be applicable to all states for which a 
Bell-type test is available, such as stabilizer states. 

We acknowledge discussions with A. Marin, D. 
Markham, T. Lawson, and A. Leverrier, and financial 
support from the ANR, Digitco, the EU and the Min- 
istry of Education, Singapore. 
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APPENDIX 

Security in the Honest Model 

We look first at the model where all n parties are hon- 
est and analyze the probability that our Test accepts a 
state as a function of the distance of this state to \&q)- 
We first analyze the case of a pure state. Denoting by 
D(\i/j), \ the trace distance between two states \ip) and 
\4>), we have 

Theorem 1. If D(\^>), \<S>%)) = e, Pr[T(|*))] < 1 - 4- 

Proof. Let X\ and Y\ be the input and output of party 
1, respectively. For Y17=i = ( m °d 2) and randomly 
chosen inputs, we have the following cases: 



1. Xi = and Yi = 0, the test passes if 

(mod 2) when Y^i=2 

1 (mod 2) when J27=2 %i 



Er= 2 Yi 



2. Xi = and Y\ = 1, the test passes if 



J 1 (mod 2) when J2i=2 -^i 



(mod 2) when £" =2 X t 



(mod 4) 
2 (mod 4) 

(mod 4) 
2 (mod 4) 



X\ = 1 and Y\ = 1, the test passes if 
(mod 2) when Y^™ =2 X. 



V™ Y 



1 (mod 4) 
1 (mod 2) when Y^™ =2 X, = 3 (mod 4) 



X\ = 1 and Y\ = 0, the test passes if 

1 (mod 2) when £™ =2 X t = 1 (mod 4) 
(mod 2) when £™ =2 X, = 3 (mod 4) 



T" Y 



We can consider the above tests on the n — 1 parties 
as projective measurements for different inputs. When 
Y^=2 Xi = (mod 2), the n—l parties perform a POVM 
{P n _i,7 — P„_i}, where the first outcome corresponds 
to case 1 and the second to case 2. When Y17=2 = 1 
(mod 2), the test is equivalent to performing a POVM 
{Qn— x,I — Q n -i}, where the first outcome corresponds 
to case 3 and the second to case 4. 

Let S n the subspace of quantum pure states of n qubits 
that are orthogonal to both |$g ) and |$™ ) , and let Is n the 
projection on this subspace. We will prove by induction 
that: 



Pn 



\n)(*d\ 



i 



i 



For n = 1, S n is the empty subspace, Pi = |0)(0| and 
Qi = so the statements hold. We now suppose 

the statements are true for n—l parties with n > 2 
and we prove it for n parties. Since the choice of X\ is 
uniformly random, wc have 



Pn = ^(|0)(0|®P„ 



+ (7-P n _i)) 



+ ^(\+)(+\®(I-Qn-l) + \-)(-\® 



l) 



We now use the induction property. Notice that 
(I - P„_i) = l*?- 1 )^?" 1 ! + ¥s n -i and (I - Q„_ x ) = 
l^r'X^I + i/s^x- Then, 



1 



P n = - (|o><o| <s> l^- 1 )^?- 1 ! + Ii><i| «> l*?- 1 )^?- 1 ! 

+ i+x+i ® i^r'x^r 1 ! + i-x-i g) i^r'x^r'i 

+ Il®Is n -i), 



where I\ is the identity operator on one qubit. 

using i$r 1 )($r 1 i+i$r 1 )($r 1 i = l*o _1 >(* 



n—l\ 



n-l\ 




Pn = 



,n-l|_ 


- wr 




we have: 




|0)(0|l 










|o)(i|i 










|i)(o|i 
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Note that 



i$»} = -L|o)i$r i )-i=|i)i$r i ) 



1$; 



and define 



1 

71 



V2 



1)1$ 



71' 



7f |1>|4 " 



n— 1\ 
1 / 

n-l\ 



After some simple calculations, we have 

p n = + + Imm + \h ® ^ 

Note also that 

h n =h®h n - l + \n)(n\ + \n)m, 

which concludes the proof for P n . To complete the 
induction, we can show in a similar way that Q n = 

Assume now that the n honest parties share a state 
with D(\ty), |$q)) = e - We can express |*) as follows: 

2 n -l 



i=l 

where for i > 2, |$f ) G 5„ and E^i" 1 <H = e - Thc 
state | VP) verifies the Test in the protocol with probability 
tr(P„|4')), so we have: 



Pr[T(|*))] 



1 - € 



= 1 

2 



2 | 2-^1=2 t 



□ 



Security in the Dishonest Model 



We look now at the model where thc honest Verifier 
runs the test in the presence of dishonest parties. Thc 
Verifier is considered to be known to all parties. Let us 
assume that there is a set H of k honest parties (the 
number and identity of all but himself are unknown to 
the Verifier) and a set D of n — k dishonest parties that 
collaborate with the quantum source. The goal of the dis- 
honest parties is to convince the Verifier that the source 
can create the n-party GHZ state, while this may not be 
true. 

Let X D := En X i ( mod 2), 7b := E D Y i (mod 2) 
denote the parity of the inputs and outputs of the dis- 
honest parties, respectively (similarly for Xjj,Yjj for the 
honest parties). Since the Verifier picks the inputs for 



all parties at random, we can describe the two equally 
probable Tests that the k honest parties perform with 
thc POVMs {P k , I- P k } and {Q k , I - Q k }, as they were 
defined before. 

More precisely, if Xd = then the Test corresponds to 
the POVM {P k ,I — P k }, where the accepting outcome is 
Pfc when Yd = 2 J2d X * (mod 2) and I — P k when Yd ^ 
i J2d Xi (mod 2). If Xd = 1 then the Test corresponds 
to the POVM {Q k , I — Q k }, where the accepting outcome 
is Q k when Y D = ±(-1 + J^d X i) ( mod 2 ) and 1 - Qk 
when Y D £ + J2 D X i) ( mod 2 )- 

We prove a theorem similar to the case of all honest 
parties. It should be clear that there is no way for the 
honest parties to determine whether the dishonest parties 
act as n — k independent parties each holding one qubit 
or whether they have colluded to one party. For example, 



the state 



l*o +1 > = 3* 



where the n — k 



>|o)-|*f>|i) 

dishonest parties hold a single qubit, passes the Test with 
probability 1, since the dishonest parties can locally map 
this state to Hence, the correct security statement 

must take into account the fact that thc dishonest parties 
may apply some operator on their space. 

Theorem 2. Let \*ft) be the state of all n parties. If 
e = mxa.u D(U\^f), |3?o))' where U is an operator on the 
space of the dishonest parties, then Pr[T'(| , I')] < 1 — 

Proof. Let us assume, without loss of generality, that the 
n parties share a state of the form 



|*> = |*S)l*o> 



(2) 



where the honest part of state \X) is orthogonal to both 
|<3?q) and and the dishonest state is not supposed 
to be normalized. For the dishonest parties, making 
the Verifier accept the Test is equivalent to guessing the 
honest output Yh before announcing their measurement 
outcomes Yd- The Helstrom measurement can provide 
the best guess for Yjj by distinguishing the dishonest 
states for the honest output Yh = and Yjj = L Let 
Pn-k = tr k \X)(X\ be the (unnormalizcd) reduced den- 
sity operator when the honest parties are traced out of 

for Xff = we have 



thc state \X). Recall that P k = |$§)($§| + ^ T s k - Hence, 



Pr[guess Y H \X H = 0] 

tr k [P k ® /„_*)*) - (/ - Pk) ® /n-Jfcl*)] 



2 2 

1 1 

2 + 2 
1 1 



l*0)<*0| + \pn-k - M*l)(*l| + \pn-k 



*o>(*o|-|*i>(*il 



[*0> 



|2\2 



4(* |*i>< 



where we calculated the trace norm as the sum of the ab- 
solute values of the eigenvalues of the matrix. Similarly, 
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we can calculate that: 

Pv[guessY H \X H = 1] 
1 



1 



2 



l*+> 



I 2x 2 



4(*+|*_>5 



We define p = |||*o)|| 2 and q = 
also 9 be the angle between 



that (\E f | v E'i) 2 = pqcos 2 9. We have 



|2\2 



lll*i)ll ■ Let 
and such 

+ 1 



Then, we diagonalize the matrix keeping only the upper 
left non-zero part for simplicity. The determinant of the 
characteristic function is: 



det(tl - A) = det 



(p — q) 2 /4.We also know that 



l/4(|||tt }|| 

|||* + )|| 2 + |||*_)ll a = J||*o>|| 2 + |||*i)|| a =P 
Since the value of Xh is random, we have: 



t — P \/pQ cos 9 
pq cos 9 t — q 

(t - p)(t - q) - pqcos 2 9 

t 2 — t(p + q) + pq sin 2 9 



q < 1. Hence, the two eigenvalues of the matrix are: 



Pr[T(|*»] = 
1 



Pr [guess Y H \X H 
1 



0]+Pr[guess Y B \X H 



*1,2 = 

We then have: 



p + q ± y/{p + q) 2 — 4pqsin 2 9 



1 




= 2 H 




1 

^2 H 




1 




= 2 H 




= 1 - 





(p- 



+ q) 2 — 4pqcos 2 9 + 2^/pq 
q) 2 — Apqcos 2 9 + 1 + 4jj<7 



+ \Jp + q- \/(jp + q) 2 — 4pqsin 2 9 S J 



> + q) 2 + Apqsin 2 9 + 2 



1 - 



(p + q) 2 + Apqsin 2 



(3) 



We consider now that the dishonest parties can perform 
a local operation on their state, in order to maximize 
their cheating probability. Thus, the distance of the dis- 
honest state from the correct one is : e = minuD((I ® 
17)|*), = minuy/l - F 2 ((I® U)\V), |$&)), where 

by |0)) we denote the fidelity between two states 

\ip) and \4>). If the reduced density matrices of the honest 
players of the perfect and the real state are o~h and pn 
respectively, it holds that there exists a local operation 
R on the dishonest state such that: 

F((I®R)\*),\^})=F(a H ,p H ) 

By considering this operation R, the distance becomes: 

e 2 < 1 - F 2 ((I ® R)\V), |$«)) = 1 - F 2 (<t h ,Ph) 

We have: 



= i (^2p + 2q + 2\J(p + q + y/(p + q) 2 - Apqsin 2 9) 
■ \J {p + q - \/ {p + q) 2 — 4pqsin 2 9)j 

= - (p + q + \/{p + q) 2 — (p + q) 2 + 4pqsin 2 6) 
1 



-(p + q + 2sin9^/pq), 



which gives 



£ 2 <1 



p + q 



pq sm(9) 



Recall that from Eq. © we have: 



Pr[T(|*))] 



[p + q) 2 + Apqsin 2 



We use the fact that (p+q) 2 < {p+q) since p+q < 1. Sim- 
ilarly, we use 4pq sin 2 9 < 2 ^Jpq sin 9 since 2y/pqsin9 < 1. 
From this, we conclude that: 



Pr[T(|*))] 



PH 



< 1 



(p + q) 2 + Apqsin 2 



sin9y/pq \ < 1 



p\$ k )(<S> k \ +g|*J)(*J| + Vwcos0(|<i> o fe )(^| + |$f)<$g|) 
+ (additional terms that include |Af)) 



□ 



Security for all honest parties 



F 2 (a HlPH ) = tr 2 (^a 1 I l 2 p H a]i 2 ) 

'( 



= tr* 



\ 



_P 

JJqcos 9 




pqcos 9 
q 




Let C e be the event that the state used for the 
computation, which we denote by is such that 

minjy Z?(£/| , l / ), |$q)) — e ' where J7 is an operator on the 
space of the dishonest parties. We prove the following: 

Theorem 3. For all e > 0, Pr[C* £ ] < 2~ s ^. 
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Proof. It is not hard to see that the optimal dishonest 
strategy that maximizes the probability of C e is to create 
at all repetitions of the protocol a state |\&) such that 
mhij/ D(U\^), |$o)) = e - I n f act J if tne source creates a 
state with smaller distance, then this does not contribute 
to the probability of event C e ; if the source creates a 
state with distance larger than e, then this increases the 
chances of unsuccessful cheating if the state is tested, 
hence decreasing the probability C e . 

Let C\ be the event that the state is used for the com- 
putation at the Z-th repetition of the protocol and is such 
that min [/ L»([/|*), > e. This implies that in all 

previous repetitions the states have been tested success- 
fully. We define the following probabilities: 

P\= Probability that the parties receive r = 0..0 from 
the CRS, which means that they use the state. This 
probability is equal to 2~ s . 

P2= Probability Party i, who becomes the Verifier, is 
honest. This probability is equal to k/n. 

Let us also define as VH: the event that the Verifier is 
Honest and as VD: the event that the verifier is dishonest. 



Note that for all states, Pr[T(|*))|VD] = 1. Then, 
Pr[C<] = P 1 (l-P 1 ) i - 1 (l-P 2 + P 2 -Pr[T(|*))|VH]) i 

r s (i-2- s ) , - 1 C— - + -fi- e 



< 2-*( 
= 2- s (l-2- s )'- 1 



n n " 4 
An . 



The infinite integral on I provides an upper bound on the 
total probability C € . We have 

r°° / k 2 \i 

Pr[C e ] < J 2 - s (l-2- s )'(l-^-) dl 



< T 



< 2~ 



1 -T~) dl 

An J 

-1 



log(l-^) 



. An 



□ 



